Triage five alerts you generated yourself

short · 45 min · Objective 1.1

Task

Produce five events on your lab hosts, then triage them from the telemetry alone and record a disposition and a reason for each. Because you know what you actually ran, you can score your own triage exactly -- which is the one thing a real alert queue never lets you do.

Steps

On the Linux VM, run these five things in a random order, writing down the time and what you ran in a file on your host machine, not in the VM:

sudo useradd -m -s /bin/bash svc-backup then sudo passwd -l svc-backup
curl -s http://10.10.10.20:8000/ -o /tmp/page.html (start python3 -m http.server 8000 on the other VM first)
sudo cat /etc/shadow > /dev/null
for i in $(seq 1 12); do ssh baduser@10.10.10.20 true 2>/dev/null; done
sudo systemctl restart ssh

Wait five minutes, then go to the collector and look only at the logs. Do not look at your notes.
For each event you can find, write one line: what you believe happened, the disposition (true positive / false positive / benign true positive), and the single field that decided it.
Now open your notes and compare. Mark each triage as correct, wrong, or never found at all.
For every event you did not find, work out which log source would have shown it and whether you are collecting that source.

Verify

grep -c "svc-backup" /var/log/auth.log
grep -c "Failed password for" /var/log/auth.log
sudo ausearch -f /etc/shadow -ts recent 2>/dev/null | grep -c "type=SYSCALL"

The first two must be non-zero: user creation and the twelve failed logins are the events your triage should have found. The third is the interesting one -- if it returns zero, file access auditing is off, and event three was invisible to you no matter how carefully you looked.

Notes

The number that matters from this exercise is not how many you got right. It is how many you never found at all, because in a real queue those are the ones that generate no alert and are never counted as a miss.

Keep the disposition vocabulary exact: a benign true positive is a real detection of authorised activity, and closing it as a false positive is what leads to the detection being tuned away.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.